Comprehensive Software Solution for Cannabis Social Clubs
On April 1st, 2024, Germany partially legalized cannabis. The new law decriminalized the possession of cannabis up to a certain amount and allowed the establishment of Cannabis Social Clubs (CSCs). These clubs are permitted to cultivate and distribute cannabis to their members under strict regulations.
The law imposes numerous requirements on CSCs, including precise tracking of cultivation, inventory, memberships, and sales. Regular inspections are also planned to ensure compliance. Managing these processes manually would be nearly impossible, yet no software solution tailored to the unique needs of CSCs existed at the time.
Recognizing this gap, we decided to build the cannabees.cloud — a comprehensive software solution designed to help CSCs stay compliant, organized, and efficient.
01_batches.mov
02_inventory.mov
03_member.mov
04_community_finance.mov
05_settings.mov
06_website_1.mp4
07_website_2.mp4
When the project was started, the focus was on frontend development. Instead of building a complex backend with numerous APIs, we chose Supabase as a no-code backend. This allowed us to quickly set up authentication, database management, and other essential services without extensive backend development.
As the project progressed, we encountered limitations with Supabase, especially when implementing complex logic and transaction control. To overcome these constraints, we introduced our own Node.js backend. This backend still interacts with Supabase but enables us to add additional validation checks and rollback mechanisms to ensure data integrity.
As a result, some operations are handled directly via Supabase in the frontend, while others go through our custom backend API, providing greater flexibility and control over the system's functionality.
- React: A JavaScript library for building user interfaces.
- Vite: A build tool that aims to provide a faster and leaner development experience for modern web projects.
- Supabase: An open-source Firebase alternative that provides backend services such as authentication, database, and storage.
- Node.js: A JavaScript runtime built on Chrome's V8 JavaScript engine.
- Express: A minimal and flexible Node.js web application framework.
- Supabase: Used for database and authentication services.
- Docker: Containerization platform to ensure consistent environments across development, testing, and production.
- GitHub Actions: CI/CD pipeline for automated testing, building, and deployment.
- Vercel: Deployment platform for frontend applications.
- Docker: Used for containerizing the backend services.
Not every club member should have the same access rights. To ensure data privacy and security, we implemented a role-based access control (RBAC) system that assigns different permissions to specific user roles.
For example, regular members can only access their own data and are restricted from viewing other members' private information. Grow team members have access to cultivation-related data and can make necessary updates. Meanwhile, board members have full read and write access to all club data to manage operations effectively.
This structured approach ensures that each user only has access to the data necessary for their role, maintaining compliance with legal requirements and protecting sensitive information.
Besides enforcing permissions at the frontend application level, we also implemented Row-Level Security (RLS) on our Supabase database. Since our platform serves multiple clubs within a single database, it was crucial to prevent unauthorized cross-access to data belonging to other clubs.
RLS policies ensure that users can only access the data associated with their own club, effectively isolating club-specific information without the need for separate databases. This additional layer of security enhances data protection and ensures strict compliance with privacy regulations.
Our goal was to provide the full functionality of our web application to customers, even on mobile devices. Since we didn't have the capacity to develop a separate native UI, we ensured that every page of our application is fully responsive.
To keep the update process seamless and avoid dependency on Play Store and App Store approval cycles, we decided to adopt a Progressive Web App (PWA) first approach. This allows us to offer most of the benefits of a native application—such as launching from the home screen—while maintaining the flexibility of web-based updates. This decision enables us to deliver a smooth user experience across all devices without the overhead of maintaining separate mobile applications.
While Supabase was an easy and convenient choice in the early stages of development, we encountered several limitations as our project grew. One challenge was customizing the built-in email services. Supabase provides methods for sending registration confirmation, password reset, and many other emails, but these templates could not dynamically include club-specific branding such as different logos and names. Since there was no way to access club data from within the email template, we had to develop our own email-sending mechanism to ensure proper customization.
Another major limitation was handling complex database operations. In many cases, we needed to update multiple tables in a specific order to maintain data integrity. However, the supabase-js client does not support ACID transactions, making it difficult to ensure consistency when performing these operations. To solve this, we implemented our own backend using Express.js, which allowed us to manage these cases effectively. For transaction safety and efficiency, we integrated Drizzle ORM, which provided robust support for structured database operations and migrations.
Setting up a robust CI/CD pipeline using GitHub Actions was another significant challenge. The pipeline needed to handle automated testing, building, and deployment for both the frontend and backend services. Ensuring that the pipeline was efficient and reliable was crucial for the project's success.
Managing different environments (development, QA, production) and ensuring that the correct configurations and secrets were used in each environment was a complex task. This involved setting up environment variables, Docker configurations, and deployment scripts.
- besides the typical technical challenges our main concern was with supabase and vercel with scaling and managing a larger application which might have forced us to switch to self hosting
- uncertainty of the market
- uncertain political future of the market and of the interpretation of the new law
- new market - blue ocean - constant changing tides leading to dynamically changing requirements
- very techy background of the team members leading to under prioritizing sales and marketing
- under estimating the slow beaurocracy of the leading institutions for giving permissions to CSCs
- Felix - Product Management
- Benedict - Software Architecture and Development 👉 GitHub Profile
- Maxim - Full-Stack Development 👉 GitHub Profile
- Henrik - Front-End Development 👉 GitHub Profile
- We used Notion to keep track of the big picture and project requirements.
- Each discussed feature or bug from Notion was transferred into a GitHub project issue and prioritized accordingly.
- Due to the young nature of the project and constantly evolving requirements, we followed a milestone release strategy - bundling certain issues into complete feature sets for each release.
This approach allowed us to maintain agility while ensuring structured progress and delivering value with each milestone.
This project showcases the integration of modern web development technologies and best practices. It demonstrates the ability to build a scalable, maintainable, and efficient web application while overcoming various challenges related to integration, CI/CD, environment management, and performance optimization.
Even though the project ended pre-revenue, after 1.5 years of development (half a year self-funded and one year supported by a public grant), we gained invaluable experience along the way:
- Discovering a new market and validating our idea with an MVP.
- Evolving the MVP into a functional SaaS product, actively used by a handful of customers.
- Understanding the importance of sales and marketing — While product development is exciting, a strong go-to-market strategy is crucial for long-term success.
Despite the challenges, this journey provided us with deep insights into product development, market validation, and the realities of launching a startup.
We hope this project serves as a testament to our skills and expertise in modern web development and cloud services.
Feel free to explore the repository and reach out if you have any questions or need further information.